sudoers_preview.sh #1

#!/bin/bash
# Generate and validate a preview only, inside the marked disposable container.
fail() { printf 'ERROR: %s\n' "$*" >&2; exit 1; }
[[ $(id -u) == 0 && -f /run/sdp-container-test && -d /p4/common ]] || fail 'Requires a provisioned disposable root container.'
mkdir -p /results || exit 1
python3 - <<'PY' > /results/sudoers-before.json
from pathlib import Path
import hashlib, json
print(json.dumps({str(p): hashlib.sha256(p.read_bytes()).hexdigest() for p in Path('/etc/sudoers.d').iterdir() if p.is_file()}, sort_keys=True))
PY
[[ $? == 0 ]] || exit 1
/p4/sdp/Server/Unix/setup/gen_sudoers.sh -limited -L /results/sudoers-preview.log || fail 'Sudoers preview generation failed.'
python3 - <<'PY'
from pathlib import Path
import hashlib, json
text = Path('/results/sudoers-preview.log').read_text()
start = text.index('Generated limited sudoers temp file:\n')
parts = text[start:].split('------------------------------------------------------------------------------\n')
assert len(parts) >= 3, 'Generated sudoers content missing'
Path('/results/generated-sudoers').write_text(parts[1])
before = json.loads(Path('/results/sudoers-before.json').read_text())
after = {str(p): hashlib.sha256(p.read_bytes()).hexdigest() for p in Path('/etc/sudoers.d').iterdir() if p.is_file()}
assert before == after, 'Preview changed installed sudoers'
PY
[[ $? == 0 ]] || fail 'Sudoers preview content or unchanged-install assertion failed.'
visudo -cf /results/generated-sudoers || fail 'Generated preview failed visudo validation.'
printf 'SDP sudoers preview validation passed\n' | tee -a /results/sudoers-preview.log